Discuz! $_DCACHE数组变量覆盖漏洞

由于Discuz! 的wap\index.php调用Chinese类里Convert方法在处理post数据时不当忽视对数组的处理,可使数组被覆盖为NULL.当覆盖$DCACHE时导致导致xss sql注射 代码执行等众多严重的安全问题.br / br / 一 分析br / /wap/index.phpbr / //43行br /pre$chs = ''; if$POST && $charset != 'utf-8' $chs = new Chinese'UTF-8', $charset; foreach$POST as $key = $value $$key =...

Discuz! 路径信息泄露漏洞

目录\ucclient\data\cache,\forumdata\cache等下面的文件里对如:br / br / $CACHE'settings' = array br / 'accessemail' = '',br / 'censoremail' = '',br / 'censorusername' = '',br / 'dateformat' = 'y-n-j',br / 'doublee' = '1',br / 'nextnotetime' = '0',br / 'timeoffset' = '28800',br / ;br / br / br /...

Discuz! member.php xss漏洞

member.php代码: if!empty$listgid && $listgid == intval$GET'listgid' //这里用的等于==而不是全等===进行的比较,且$listgid并没有初始化: $type = $adminid == 1 ? 'grouplist' : $type; else $listgid = ''; ... $multipage = multi$num, $memberperpage, $page,...

Discuz! 数据库错误信息xss bug

在文件include\dbmysqlerror.inc.php里代码: if$message $errmsg = "bDiscuz! info/b: $message\n\n"; ifisset$GLOBALS'DSESSION''discuzuser' $errmsg .= "bUser/b: ".htmlspecialchars$GLOBALS'DSESSION''discuzuser'."\n"; $errmsg .= "bTime/b: ".gmdate"Y-n-j g:ia", $timestamp + $GLOBALS'timeoffset' 3600."\n"; $errm...

Discuz!4.x wap\index.php 变量覆盖漏洞

Discuz!4.x一直存在着一个变量覆盖漏洞n年了.代码如下: $chs = ''; if$POST && $charset != 'utf-8' $chs = new Chinese'UTF-8', $charset; foreach$POST as $key = $value $$key = $chs-Convert$value; //foreach处理$POST导致变量覆盖 unset$chs;...

Discuz! admincp.php xss bug

漏洞存在于文件admin/login.inc.php里$urlforward没有被过滤导致xss漏洞: input type="hidden" name="urlforward" value="$urlforward" 2008-02 www.Discuz.net http://127.0.0.1/discuz/admincp.php?urlforward=%22%3E%3Cscript%3Ealert/xss/%3C/script%3E 管理员或版主前台登录,但未登录后台时触发...

Discuz!cache.func.php 信息泄漏

漏洞存在于文件\include\cache.func.php里的代码如下: define'DISCUZKERNELVERSION', '6.1.0'; define'DISCUZKERNELRELEASE', '20080418'; ifisset$GET'kernelversion' exit'Crossday Discuz! Boardbr /Developed by Comsenz Inc.br /br /Version: '.DISCUZKERNELVERSION.'br /Release: '.DISCUZKERNELRELEASE;...

Discuz! admin\runwizard.inc.php get-webshell bug

由于Discuz!的admin\runwizard.inc.php里saverunwizardhistory写文件操作没有限制导致执行代码漏洞. 在文件admin\runwizard.inc.php里代码: $runwizardhistory = array; $runwizardfile = DISCUZROOT.'./forumdata/logs/runwizardlog.php'; if$fp = @fopen$runwizardfile, 'r' $runwizardhistory = @unserializefread$fp, 99999; fclose$fp;...

Discuz! flash csrf vul

Discuz!的安全人员已经意识到csrf方面的漏洞了采用了formhash及判断Referer等来防止外部提交,如果看过Bypass Preventing CSRF1一文的朋友应该意识到我们可以通过flash来进行csrf攻击. 首先我们看Discuz!6开始自带了crossdomain.xml文件,代码如下: ?xml version="1.0"? cross-domain-policy allow-access-from domain="" / /cross-domain-policy 允许容易域的访问,对于Discuz!的formhash我们可以通过as来处理得到如下代码:...

Discuz! modcp/moderate.inc.php 数据库注射漏洞

在文件modcp\moderate.inc.php里代码: requireonce DISCUZROOT.'./include/discuzcode.func.php'; requireonce DISCUZROOT.'./include/attachment.func.php'; $ppp = 10; $page = max1, intval$page; $startlimit = $page - 1 $ppp; $modcount = $db-resultfirst"SELECT COUNT FROM $tablepreposts WHERE invisible='$pstat' A...

Discuz! trade.php 数据库'注射'漏洞

文件trade.php: $message = trim$message; if$message $message = daddslashes$tradelog'message', 1."\t\t\t".$discuzuid."\t".$discuzuser."\t".$timestamp."\t".nl2brstriptagssubstr$message, 0, 200; //$message用substr处理了下,取前200个字符 else $message = daddslashes$tradelog'message', 1; $db-query"UPDATE...

Discuz! moderation.inc.php 数据库'注射'漏洞

在文件include/moderation.inc.php里代码: $threadlist = $loglist = array; if$tids = implodeids$moderate $query = $db-query"SELECT FROM $tableprethreads WHERE tid IN $tids AND fid='$fid' AND displayorder='0' AND digest='0' LIMIT $tpp"; while$thread = $db-fetcharray$query ... $threadlist$thread'tid' =...

Discuz!/phpwind flash标签的xss

flash标签的xss在以前的是很流行的,以前只要随便一个调用外面的一个swf就ok了,现在的则都不可以直接使用调用外码的swf了,这个是因为一般都设置了allowScriptAccess12.比如dz的codz: dz60904\upload\forumdata\cache\cachebbcodes.php 同样出现在cacheviewthread.php cachepost.php cacheblog.php里 00017: 0 = 'marquee width="90%" behavior="alternate" scrollamount="3"\1/marquee', 00018...

Discuz 6.X [flash] xss bug

其实该漏洞在2007年就公布过了1,但是经过80vul-A测试改漏洞一直没有被修补。该漏洞的分析主要点如下： 第一:Discuz!把allowScriptAccess设置为sameDomain:param name="allowScriptAccess" value="sameDomain"我们只需要把swf文件上传到目标上就可以使用flash调用我们构造的swf了。 第二:由于html调用flash是不限制后缀的，所以攻击者可以用图片文件的后缀如gif通过论坛的上传功能上传，上传功能只是使用了getimagesize来判断，但是swf一样可以通过该函数。 Discuz 6.X...

The latest Discuz! NT2. 5 vulnerability to report! - Vulnerability warning-the black bar safety net

Title: the latest Discuz! NT2. 5 vulnerability to report! Author: hackest H. S. T. This article has been published in the hacker X-Files for 2 0 0 8 P 1 0 issue of the magazine on After the author published on the blog, such as reproduced please retain this information! Summer, passion in August,...

The latest Discuz! NT2. 5 vulnerability-vulnerability warning-the black bar safety net

Author: hackest H. S. T. This article has been published in the hacker X-Files for 2 0 0 8 P 1 0 issue of the magazine on After the author published on the blog, such as reproduced please retain this information! Summer, passion in August, so excited about the Beijing Olympic Games has finally...

Discuz! 6.0.1 (searchid) Remote SQL Injection Exploit-vulnerability warning-the black bar safety net

The following proceduresmethodsmay carry offensive,for security research and teaching purposes,at your own risk!& lt;? php errorreportingEALL&ENOTICE; printr" +------------------------------------------------------------------+ Exploit discuz6. 0. 1 Just work as php=5 & mysql=4.1 BY james...

Discuz!NT 2.5 showuser.aspx注入漏洞

No description provided by source...

Discuz Spache.php注射漏洞

discuz的空间功能 space.php $member = $db-fetchfirst"SELECT m., mf., u.grouptitle, u.type, u.creditshigher, u.creditslower, u.readaccess, u.color AS groupcolor, u.stars AS groupstars, u.allownickname, u.allowuseblog, r.ranktitle, r.color AS rankcolor, r.stars AS rankstars $oltimeadd1 FROM...

Discuz space. php injection vulnerability analysis-vulnerability warning-the black bar safety net

$member = $db-fetchfirst"SELECT m., mf., u. grouptitle, u. type, u. creditshigher, u. creditslower, u. readaccess, u. color AS groupcolor, u. stars AS groupstars, u. allownickname, u. allowuseblog, r. ranktitle, r. color AS rankcolor, r. stars AS rankstars $oltimeadd1 FROM $tablepremembers m LEFT...